@everystack/cli 0.2.37 → 0.2.40

package/src/cli/security-catalog.ts

@@ -0,0 +1,170 @@
+/**
+ * Catalog instrument for security:audit — the post-deploy half.
+ *
+ * Static parsing gates the PR from the migration SQL; this introspects the *live*
+ * database (pg_proc / pg_class / pg_attribute, with role inheritance resolved by
+ * `has_table_privilege`) to catch deployed-state drift and anything created
+ * out-of-band that the migration files never described.
+ *
+ * The SQL runs through the ops Lambda (`db:query`); the mappers here are pure and
+ * unit-tested without a database.
+ */
+
+import type {
+  FunctionDescriptor,
+  ViewDescriptor,
+  ReturnClass,
+} from './security-audit.js';
+
+/**
+ * Enumerate every function with its security context. Excludes system schemas and
+ * extension-owned functions (pgcrypto, PostGIS) via pg_depend, so vendor functions
+ * never need a manual waiver.
+ */
+export const FUNCTIONS_SQL = `
+SELECT
+  n.nspname AS schema,
+  p.proname AS name,
+  pg_get_function_result(p.oid) AS return_type,
+  p.prosecdef AS security_definer,
+  p.proretset AS returns_set,
+  t.typtype AS return_typtype,
+  EXISTS (
+    SELECT 1 FROM unnest(coalesce(p.proconfig, '{}'::text[])) cfg
+    WHERE lower(cfg) LIKE 'search_path=%'
+  ) AS has_search_path,
+  pg_get_userbyid(p.proowner) AS owner,
+  -- Does the owner run above RLS? A SECURITY DEFINER function owned by such a role is
+  -- the maximum blast radius — search_path pinning is necessary but not sufficient.
+  -- RDS has no true superuser (rolsuper=false), so also check rds_superuser membership.
+  (
+    SELECT r.rolsuper OR r.rolbypassrls OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_bypasses_rls
+FROM pg_proc p
+JOIN pg_namespace n ON n.oid = p.pronamespace
+JOIN pg_type t ON t.oid = p.prorettype
+WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (
+    SELECT 1 FROM pg_depend d
+    WHERE d.objid = p.oid AND d.deptype = 'e'
+  )
+ORDER BY n.nspname, p.proname;
+`.trim();
+
+/**
+ * Enumerate relations (tables, views, matviews) with their columns and whether
+ * SELECT is reachable from a broad role. `has_table_privilege` resolves role
+ * inheritance and PUBLIC grants, so a view granted to an intermediate role that
+ * `authenticated` inherits is correctly flagged broadly-exposed.
+ */
+export const RELATIONS_SQL = `
+WITH targets AS (
+  SELECT rolname FROM pg_roles WHERE rolname IN ('anon', 'authenticated')
+)
+SELECT
+  n.nspname AS schema,
+  c.relname AS name,
+  c.relkind AS relkind,
+  (
+    SELECT array_agg(a.attname ORDER BY a.attnum)
+    FROM pg_attribute a
+    WHERE a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+  ) AS columns,
+  EXISTS (
+    SELECT 1 FROM targets tg
+    WHERE has_table_privilege(tg.rolname, c.oid, 'SELECT')
+  ) AS broadly_exposed
+FROM pg_class c
+JOIN pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind IN ('r', 'v', 'm')
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_%'
+  AND NOT EXISTS (
+    SELECT 1 FROM pg_depend d
+    WHERE d.objid = c.oid AND d.deptype = 'e'
+  )
+ORDER BY n.nspname, c.relname;
+`.trim();
+
+/** Coerce a Postgres boolean (true | 't' | 'true' | 1) into a JS boolean. */
+function truthy(v: unknown): boolean {
+  return v === true || v === 't' || v === 'true' || v === 1 || v === '1';
+}
+
+/** Parse a text[] that may arrive as a JS array or a `{a,b,c}` literal string. */
+export function parsePgArray(v: unknown): string[] | null {
+  if (v == null) return null;
+  if (Array.isArray(v)) return v.map(String);
+  if (typeof v === 'string') {
+    const trimmed = v.trim();
+    if (trimmed === '{}' || trimmed === '') return [];
+    if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+      return trimmed
+        .slice(1, -1)
+        .split(',')
+        .map((s) => s.replace(/^"|"$/g, '').trim())
+        .filter((s) => s.length > 0);
+    }
+  }
+  return null;
+}
+
+interface FunctionRow {
+  schema: string;
+  name: string;
+  return_type: string;
+  security_definer: unknown;
+  returns_set: unknown;
+  return_typtype: unknown;
+  has_search_path: unknown;
+  owner?: unknown;
+  owner_bypasses_rls?: unknown;
+}
+
+/** Map a pg_proc row to a descriptor, computing a precise return class. */
+export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescriptor {
+  const text = String(row.return_type ?? '').trim().toLowerCase();
+  let returnClassHint: ReturnClass;
+  if (text === 'void' || text === 'trigger' || text === '') {
+    returnClassHint = 'void';
+  } else if (truthy(row.returns_set) || row.return_typtype === 'c' || text === 'record' || text.startsWith('setof') || text.startsWith('table(')) {
+    returnClassHint = 'rows';
+  } else {
+    returnClassHint = 'scalar';
+  }
+
+  return {
+    schema: row.schema,
+    name: row.name,
+    returnType: row.return_type,
+    returnClassHint,
+    securityDefiner: truthy(row.security_definer),
+    hasSearchPath: truthy(row.has_search_path),
+    owner: row.owner != null ? String(row.owner) : undefined,
+    ownerBypassesRls: row.owner_bypasses_rls != null ? truthy(row.owner_bypasses_rls) : undefined,
+  };
+}
+
+interface RelationRow {
+  schema: string;
+  name: string;
+  relkind: string;
+  columns: unknown;
+  broadly_exposed: unknown;
+}
+
+/** Map a pg_class row to a view/table descriptor. */
+export function catalogRelationToDescriptor(row: RelationRow): ViewDescriptor {
+  return {
+    schema: row.schema,
+    name: row.name,
+    kind: row.relkind === 'r' ? 'table' : 'view',
+    columns: parsePgArray(row.columns),
+    broadlyExposed: truthy(row.broadly_exposed),
+  };
+}

package/src/storage/index.ts

@@ -1,3 +1,5 @@
+import type { S3StorageOptions } from './s3';
+
 export interface StorageAdapter {
   put(key: string, data: Buffer | Uint8Array, contentType?: string): Promise<void>;
   get(key: string): Promise<{ data: Buffer; contentType: string } | null>;
@@ -32,7 +34,18 @@ export interface StorageAdapter {
 
 export type StorageOptions =
   | { type: 'filesystem'; directory: string }
-  | { type: 's3'; bucket: string; region?: string; endpoint?: string };
+  | {
+      type: 's3';
+      bucket: string;
+      region?: string;
+      endpoint?: string;
+      /**
+       * Bound the S3 client's failure modes (connect/request timeouts, retries,
+       * list caps). Every field defaults to a safe bound; env vars override too.
+       * See {@link S3StorageOptions}.
+       */
+      options?: S3StorageOptions;
+    };
 
 export async function createStorage(options: StorageOptions): Promise<StorageAdapter> {
   if (options.type === 'filesystem') {
@@ -40,8 +53,8 @@ export async function createStorage(options: StorageOptions): Promise<StorageAda
     return new FilesystemStorageAdapter(options.directory);
   }
   const { S3StorageAdapter } = await import('./s3');
-  return new S3StorageAdapter(options.bucket, options.region, options.endpoint);
+  return new S3StorageAdapter(options.bucket, options.region, options.endpoint, options.options);
 }
 
 export { FilesystemStorageAdapter } from './filesystem';
-export { S3StorageAdapter } from './s3';
+export { S3StorageAdapter, type S3StorageOptions } from './s3';

package/src/storage/s3.ts

@@ -1,15 +1,58 @@
 import type { StorageAdapter } from './index';
 
+/**
+ * Tuning for the S3 client's failure modes. Every value is bounded by default so
+ * a single call can never hang: under an S3 503 SlowDown storm an unbounded
+ * client blocks until the Lambda's own timeout (60s), and because each hung
+ * invocation pins a concurrency slot, the observability rollup can drain the
+ * whole account pool and starve the app it observes. Bounded here, a stuck call
+ * fails fast instead. Overridable per-field, then by env (so ops can tighten a
+ * live Lambda without a code redeploy), then these defaults.
+ */
+export interface S3StorageOptions {
+  /** TCP connect timeout, ms. Env: EVERYSTACK_S3_CONNECT_TIMEOUT_MS. */
+  connectionTimeoutMs?: number;
+  /** Socket-idle timeout for a single request, ms. Env: EVERYSTACK_S3_REQUEST_TIMEOUT_MS. */
+  requestTimeoutMs?: number;
+  /** Total attempts per call (1 + retries). Env: EVERYSTACK_S3_MAX_ATTEMPTS. */
+  maxAttempts?: number;
+  /** Keys per ListObjectsV2 page (S3 caps this at 1000). */
+  listMaxKeys?: number;
+  /** Hard backstop on pages a single list() will walk before truncating (warns). */
+  listMaxPages?: number;
+}
+
+function envInt(name: string): number | undefined {
+  const raw = process.env[name];
+  if (raw === undefined) return undefined;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
 export class S3StorageAdapter implements StorageAdapter {
   private bucket: string;
   private region: string;
   private endpoint?: string;
   private client: any;
 
-  constructor(bucket: string, region?: string, endpoint?: string) {
+  private readonly connectionTimeoutMs: number;
+  private readonly requestTimeoutMs: number;
+  private readonly maxAttempts: number;
+  private readonly listMaxKeys: number;
+  private readonly listMaxPages: number;
+
+  constructor(bucket: string, region?: string, endpoint?: string, options: S3StorageOptions = {}) {
     this.bucket = bucket;
     this.region = region || 'us-east-1';
     this.endpoint = endpoint;
+
+    this.connectionTimeoutMs =
+      options.connectionTimeoutMs ?? envInt('EVERYSTACK_S3_CONNECT_TIMEOUT_MS') ?? 3000;
+    this.requestTimeoutMs =
+      options.requestTimeoutMs ?? envInt('EVERYSTACK_S3_REQUEST_TIMEOUT_MS') ?? 10000;
+    this.maxAttempts = options.maxAttempts ?? envInt('EVERYSTACK_S3_MAX_ATTEMPTS') ?? 3;
+    this.listMaxKeys = options.listMaxKeys ?? 1000;
+    this.listMaxPages = options.listMaxPages ?? 1000;
   }
 
   private async getClient(): Promise<any> {
@@ -17,6 +60,15 @@ export class S3StorageAdapter implements StorageAdapter {
       const { S3Client } = await import('@aws-sdk/client-s3');
       this.client = new S3Client({
         region: this.region,
+        // Bounded retries — the SDK default (3) is fine, but pin it so a config
+        // drift can't reintroduce unbounded blocking under throttling.
+        maxAttempts: this.maxAttempts,
+        // Connect + per-request timeouts. Without these a call can block forever
+        // on a stalled socket (the 60s-hang class the rollup outage rode in on).
+        requestHandler: {
+          connectionTimeout: this.connectionTimeoutMs,
+          requestTimeout: this.requestTimeoutMs,
+        },
         ...(this.endpoint ? { endpoint: this.endpoint, forcePathStyle: true } : {}),
       });
     }
@@ -136,11 +188,13 @@ export class S3StorageAdapter implements StorageAdapter {
     const client = await this.getClient();
     const keys: string[] = [];
     let continuationToken: string | undefined;
+    let pages = 0;
 
     do {
       const response = await client.send(new ListObjectsV2Command({
         Bucket: this.bucket,
         Prefix: prefix,
+        MaxKeys: this.listMaxKeys,
         ContinuationToken: continuationToken,
       }));
       if (response.Contents) {
@@ -149,6 +203,17 @@ export class S3StorageAdapter implements StorageAdapter {
         }
       }
       continuationToken = response.IsTruncated ? response.NextContinuationToken : undefined;
+      pages += 1;
+      // Backstop: a prefix that walks past the page cap is almost always a sign
+      // the rollup's per-hour debounce isn't engaged (one object → one invoke).
+      // Truncate loudly rather than let a single list() run unbounded.
+      if (continuationToken && pages >= this.listMaxPages) {
+        console.warn(
+          `[s3] list('${prefix}') hit the ${this.listMaxPages}-page cap at ${keys.length} keys; truncating. ` +
+            `A prefix this large usually means the observability rollup is being invoked per-object instead of per-hour.`,
+        );
+        break;
+      }
     } while (continuationToken);
 
     return keys;